topic Re: ISE - Wired Dot1x EAP-TLS - Intermittent in Network Access Control

ISE - Wired Dot1x EAP-TLS - Intermittent

cegsm — Wed, 08 Feb 2023 15:10:39 GMT

New to ISE and want to use it for Dot1x authentication of windows AD clients using computer certificates with a Cisco 2960X switch.

I've got this working and the live logs show success and always end with a 'Returned RADIUS Access-Accept'

My issue is that half of the time the client shows as failed authentication, often after being disconnected and reconnected, seems to work ok after most reboots. This happens even when the ISE logs showed success.

I'd be grateful for any help or suggestions on troubleshooting.

Thanks

Re: ISE - Wired Dot1x EAP-TLS - Intermittent

Nancy Saini — Wed, 08 Feb 2023 17:20:10 GMT

Hi @cegsm

I would suggest checking below at the time of issue:

Authentication status of the endpoint on the network device.
IP connectivity on the client. Is it able to reach the network?
Any failed authentication request seen on the ISE server.
Check EAP, dot1x and RADIUS debugs on the network device.

Are clients connecting to the network via AnyConnect NAM or native supplicant?

Re: ISE - Wired Dot1x EAP-TLS - Intermittent

Greg Gibbs — Wed, 08 Feb 2023 21:28:12 GMT

There is not enough information to provide any meaningful assistance for this issue. See How to Ask the Community for Help.

You should start by comparing your environment against the ISE Secure Wired Access Prescriptive Deployment Guide.

If you are new to ISE concepts, you might also want to review some of the relevant ISE Webinar training videos.

Re: ISE - Wired Dot1x EAP-TLS - Intermittent

Massimo Baschieri — Thu, 09 Feb 2023 05:24:15 GMT

Check Cisco Bug: CSCvv93417, if conditions are met, upgrading to latest release will do the trick

Re: ISE - Wired Dot1x EAP-TLS - Intermittent

cegsm — Thu, 09 Feb 2023 09:51:12 GMT

Hi Massimo

We were indeed on the affected version, after moving the test laptops to the master switch it works perfectly

Thanks very much !